feat(pfi-gx10): register the ASUS Ascent GX10 and convert it to headless

NVIDIA GB10, aarch64, 121 GB unified, sm_121. Ships booting to graphical.target
with GDM and GNOME Remote Desktop running.

playbooks/gx10-headless.yaml sets multi-user.target, stops gnome-remote-desktop,
masks the sleep/suspend/hibernate targets, makes logind ignore lid and idle, and
adds sshd keepalives so a stalled link does not kill a long-running job.

Two things learned the hard way and recorded in the playbook:

- gdm is a STATIC unit on Ubuntu, pulled in by display-manager.service and never
  'enabled'. A guard of  always skips, and a verify
  written the same way passes while the desktop is still running. Both now test
  is-active. The first run reported six green verifies having not stopped gdm.
- elway's --sudo applies only to ad-hoc --shell/--upload. Playbook steps run as
  the connecting user and must carry their own sudo; connect as infra-ops.

The playbook refuses to stop the display manager while a seat session is held,
overridable with --var force_dm_stop=true. Networking is deliberately out of
scope: the box is on a desk on Wi-Fi with a temporary DHCP lease and no ethernet
carrier, and belongs to the rack-install change.

servers/pfi-gx10/README.md

@@ -0,0 +1,57 @@
+# pfi-gx10 — ASUS Ascent GX10 (NVIDIA GB10)
+
+Grace-Blackwell desktop supercomputer. Registered 2026-09-01.
+
+| | |
+|---|---|
+| GPU | **NVIDIA GB10**, driver 580.173.02, **compute capability 12.1 (`sm_121`)** |
+| CPU | 20 cores, **aarch64** |
+| Memory | **121 GB unified** (CPU and GPU share it — not 121 GB *plus* VRAM) |
+| Storage | 916 GB NVMe, 6% used |
+| Kernel | 6.17.0-1031-nvidia |
+| Hostname | `pfi-gx10` (shipped with static `gx10-a745`, corrected) |
+
+## ⚠ The address in `ssh-target` is TEMPORARY
+
+As of 2026-09-01 this box is **on a desk, on Wi-Fi**, holding a DHCP lease at
+`10.100.10.226` on `nh3-userland` (VLAN 10). Ethernet `enP7s7` has no carrier.
+
+It is going into the rack later. At that point it needs a wired link, a static
+address, a decision about VLAN placement (a compute node arguably belongs on
+`nh3-servers`, VLAN 50, with the rest of them), a `dns/internal.yaml` entry, and
+this file plus `ssh-target` updated. **None of that was configured now** — an
+address that is about to be wrong is worse than DHCP.
+
+Expect ~65–80 ms RTT until it is wired. That is Wi-Fi power-save, not a fault.
+
+## Access
+
+`infra-ops` with NOPASSWD sudo (operator-bootstrapped). `lkraven` also has key
+auth but needs a password for sudo — **automation must connect as `infra-ops`**.
+
+## Headless conversion
+
+`playbooks/gx10-headless.yaml` — run it with the `infra-ops@` prefix, since
+elway's `--sudo` applies only to ad-hoc commands and playbook steps carry their
+own.
+
+Ships booting to `graphical.target` with GDM and GNOME Remote Desktop. The
+playbook sets `multi-user.target`, stops the remote-desktop service, masks the
+sleep/suspend/hibernate targets, tells logind to ignore lid and idle, and adds
+sshd keepalives so a stalled link does not kill a long job.
+
+⚠ **GDM is `static` on Ubuntu** — pulled in by `display-manager.service`, never
+"enabled". Guard and verify on `is-active`, not `is-enabled`; the latter passes
+trivially while the desktop is still running.
+
+The playbook will not stop GDM while someone holds a seat session. Override with
+`--var force_dm_stop=true`, or just let the rack-install reboot handle it.
+
+## Relevance to Flash-Next
+
+`sm_121`, not `sm_120`. The SGLang fork evaluated for ana-ml2 (henge item 49)
+narrows to **exact SM120 and explicitly excludes SM121/GB10** — it does not apply
+here. This chip has its own path: the DGX Spark recipe, which mmaps the ~48 GiB
+PLE n-gram table from NVMe rather than holding it in memory. 121 GB unified and
+822 GB of free NVMe make that viable on this box in a way it is not on a 96 GB
+discrete card.

servers/pfi-gx10/ssh-target

@@ -0,0 +1 @@
+infra-ops@10.100.10.226